Web3 Security Research

A vast teal wall of stacked machined deposit cells resting on a single small red counterweight whose steel base plate is buckling under the load

Tectonic's $75M Exploit: A $1.34M Token Underwrote $119M of Loans

An attacker pumped Tectonic's own governance token about 100x in 20 minutes, borrowed against it, and emptied the largest lending market on Cronos. Validators halted the chain.

Dmitry Serdyuk·Aug 31, 2026

Dark isometric illustration of a signing machine seen from a raised corner: ranks of interlock stations with red locking bars and one empty socket, a teal engraved notch-plate lit under glass on a reading stand, a different red-inked notch-plate clamped in the press bed directly below it, and a cropped gloved hand sliding a second brass plate into the open station

technical

Ledger's Clear Signing Race: One Extra APDU Could Swap the Transaction You Approved

Ledger shipped twenty-one fixes in Ethereum app 1.22.2 under a two-word changelog line. The git history shows what they closed: a second command could replace the transaction behind the screen.

Dmitry Serdyuk·Aug 25, 2026

Dark top-down illustration of a records table packed edge to edge with identical teal registration cards, one card near the centre set back rotated with a red re-struck stamp panel and an off-centre re-punched hole, a gloved hand entering at the bottom edge

exploits

Tornado Cash Frontend Phishing: 810 ETH Drained After the Domain Lapsed

Reports put the loss at 1,010 ETH. The pools tell a tighter story: nine withdrawals, 810 ETH, eight minutes, and a collection wallet the attacker funded out of the mixer itself six days earlier.

Dmitry Serdyuk·Aug 24, 2026

$Dark abstract extreme close-up of a struck teal metal token whose deep embossed concentric seal is split by a hairline red-lit fracture, through which the interior shows hollow, a sanctioned mark backed by an empty core$

exploits

Maya Protocol $1.7M Exploit: Six Chained Bugs Became One Uncapped Slash Subsidy

One 23-message transaction chained six medium bugs into a critical: a false theft alert minted 49.45M CACAO into a thin pool the attacker then owned 99.93% of, draining 20.83 BTC.

Dmitry Serdyuk·Aug 20, 2026

Cutaway of a price gauge: a teal needle frozen against a tick mark, disconnected by a severed brass rod from two tilted reserve chambers below, one glowing red

exploits

FoxMarket $119K Exploit: A Stale LP Bond Price Minted Free FOX

FoxMarket lost about $119K on BNB Chain when its LP bond pool priced a mint from a PancakeSwap spot quote read before the attacker's own swap moved that same pool.

Dmitry Serdyuk·Aug 19, 2026

Dark abstract illustration of a machined inspection hall receding into depth, twenty-eight identical teal verification armatures clamped on brass tally plates in ranked bays, with a small red slip in a foreground guide channel whose retaining notch was never cut

exploits

Coreum Bridge $200K Exploit: 17 Signers and One Missing Destination Check

The tx XRPL bridge lost 199,916 XRP in 94 multisig payments because its relayer confirmed that a memo appeared in the bridge's transaction history, never that money reached the bridge.

Dmitry Serdyuk·Aug 18, 2026

Top-down view of a dense residential district model in cold teal, rooftops packed edge to edge, dozens of red map pins with small blank tags standing out of scattered houses, a cropped gloved hand pressing another pin into one roof, and opened delivery cartons stacked at one corner.

exploits

SafePal Order Data Leak: 39,798 Wallet Buyers Exposed by an Authorization Flaw

An authorization flaw in a third-party order-tracking plug-in let anyone read another SafePal customer's order by changing the order number. What left the building was the hardware wallet buyer list.

Dmitry Serdyuk·Aug 17, 2026

Macro close-up of a small brass tag riveted to rough unmachined cast iron, marked with a circular inspection punch struck into the tag itself and a red grease-pencil check, beside faint teal scribe lines and a polished machined corner of a neighbouring part

exploits

Ravencoin's KAWPOW Bug: A Block That Lies About Its Own Height Skips the Mining Work

A header field nodes never checked let blocks skip ProgPoW entirely and mine at a fraction of the honest cost. Two mining pools answered by rewinding about three days of chain history.

Dmitry Serdyuk·Aug 14, 2026

Dark abstract cutaway of layered machined strata seen from a raised corner, a clean bored shaft passing untouched through a reinforced teal shutter lattice at the top and ending at a single red-lit cell with a missing retaining bracket deep in the oldest layer, a cropped gloved hand entering at the lower right

exploits

Harmony's 4 Billion ONE Mint: The Replay Fix the Attacker Could Switch Off

An attacker minted about 4 billion ONE, roughly 26% of supply. Harmony's replay defense read its activation epoch from inside the proof, so the proof decided whether the defense applied.

Dmitry Serdyuk·Aug 13, 2026

Cross-lit dark scene: an enormous teal wall of key drawers recedes into depth, each with a lock and a milled notch tab, while a small red cabinet in the foreground holds only a few dozen drawers bearing the same tabs, pulled open, with two back-turned figures reaching into the same one.

exploits

Ill Bloom: A 12-Year-Old CryptoJS PRNG Bug Drained $5.7M in Guessable Seeds

CryptoJS seeded its randomness from Math.random(), cutting 128-bit wallet entropy to about 2^39. Attackers enumerated the phrases and swept 1,034 accounts. Upgrading does not fix a key already made.

Dmitry Serdyuk·Aug 11, 2026

A dense wall of identical machined steel verification bays, each holding a teal credential token in a keyed socket below a lit teal indicator lamp. One bay's socket is a dark empty recess while its lamp still burns the same bright teal as its neighbours, and a red duplicate of the token lies askew on a shelf to its lower left.

exploits

BTCPay Server's Stolen Macaroons: Why Updating to 2.4.2 Does Not End It

Attackers stole LND macaroon credentials from BTCPay servers, closed merchant Lightning channels and swept the funds. Version 2.4.2 shuts the door. It does not revoke the keys already copied.

Dmitry Serdyuk·Aug 10, 2026

A dense dark wall of racked teal authorization plates, each stamped with an identical blank seal in its upper corner and a shallow value channel along its lower edge, crossed by a rigid reader bar whose contact fingers touch only the seal corners; one plate glows red with a matching seal and a value channel cut into a deep trench the reader never reaches.

exploits

Swan Treasury's $625K Signer Key Leak: One Key, Three Contracts, Five Cents of Gas

A leaked off-chain signer key let an attacker sign their own discount. Swan Treasury's buy() function checked who signed the message and never checked what the message asked for.

Dmitry Serdyuk·Aug 7, 2026

Dark abstract illustration of a dense teal machined register plate whose rows of milled cells are indexed from two opposite edges, with one cell duplicated in a single row and its second copy raised and lit red

exploits

Verus Bridge $7.5M Exploit: When Two Chains Read the Same Bytes Differently

An attacker poisoned Verus notarizations with duplicate state roots that Verus and Ethereum parsed differently, draining $7.5M from a bridge already drained for $11.58M nine weeks earlier.

Dmitry Serdyuk·Aug 6, 2026

Cutaway cross-section of a hardware wallet board: the hardware random number generator die sits dark with its bond wires ending at bare pads, while a small brass counter wheel is wired into its place and the seed register beside it stays mostly empty.

exploits

Coldcard's $88.6M Entropy Failure: Five Years of Guessable Bitcoin Seeds

A March 2021 build error routed Coldcard seed generation to a software PRNG instead of the hardware RNG. Five years later, attackers swept 1,367 BTC from 4,585 addresses without touching a device.

Aron Turner·Aug 3, 2026

A small crisp teal block set against a vast red striated volume that runs past the frame, a size comparison between a short secured window and a far longer unwatched one

exploits

Triple-A's $11.8M Hot Wallet Drain: Seven Chains, and 31 Hours Nobody Closed the Tap

Triple-A's treasury wallets were swept across seven chains starting July 24, 2026. The theft took hours. Deposits kept arriving and kept being swept for 31.

Dmitry Serdyuk·Jul 30, 2026

A large teal machined ring seen head on against black, its inner core replaced by a mismatched dull red disc whose engraving does not line up with the ring, joined by a clean hairline seam

exploits

B2 Network $3.86M Staking Drain: The Upgrade Key Did All the Work

B2 Network lost 8.59M B2 tokens, about $3.86M, when someone used the staking contract's upgrade authority. That privilege had sat on the same wallet since 2025.

Dmitry Serdyuk·Jul 27, 2026

Five identical validator signature keys emerging from a single compromised red enclosure, together opening a bridge gate as teal value drains across the span into one dark vault

exploits

AFX Trade $24.15M Bridge Exploit: Compromised Validator Keys Signed a Valid Drain

AFX Trade's bridge lost $24.15M in USDC on Arbitrum. No contract bug: five operator-held validator keys signed a real quorum, and the bridge did exactly as told.

Dmitry Serdyuk·Jul 24, 2026

A teal wireframe repository lattice with one cracked block exposing a dense red core, splitting into three red filaments that converge on a single pulsing red node

exploits

The Fake Recruiter Repo That Hid Its Malware in a Tailwind Config

A fake Web3 recruiter sends a GitHub repo to try before the interview. The malware hides as a 4 MB Tailwind plugin, fires on the dev command, and hunts wallets, SSH keys, and seed phrases.

Dmitry Serdyuk·Jul 23, 2026

A counterfeit code-editor plugin icon glowing red, its data filaments feeding a chain of teal hexagonal blocks with one attacker-controlled node pulsing red, branching to three compromised endpoints

exploits

The TRAE Extension Backdoor That Ran Its C2 on an Ethereum Contract

A fake Solidity plugin, juannegro.solidity, backdoors Windows, macOS, and Linux dev machines and reads its C2 address from an Ethereum contract the attacker updates on-chain.

Dmitry Serdyuk·Jul 22, 2026

Abstract illustration of a flash loan pool manipulation: two teal stablecoin streams share one tilted basin while a looping bright pulse skews their balance and red value drains across a dark gap to a distant chain node, over dark circuitry.

exploits

Allbridge Core $1.65M Exploit: A 2023 Flash Loan Fix That Missed Solana

Allbridge Core lost $1.65M on Solana to the same flash loan trick it said it fixed in 2023. The one-pool promise held on BNB Chain and not on Solana.

Dmitry Serdyuk·Jul 21, 2026

Abstract illustration of a lending exploit: teal concentrated-liquidity bands meet a translucent vault of stacked cells, and red value drains through the misaligned seam where the two accounting systems meet, over dark circuitry.

exploits

DefiTuna Exploit: $580K Drained From Solana Lending Pool

DefiTuna's USDC lending pool lost $580K to a July 2026 exploit on Solana, leaving it in bad debt. Inside the attack, the Sec3 audit gap, and the lessons.

Aron Turner·Jul 20, 2026

Abstract teal circuit board where one npm package node fans out into eighteen child nodes, with a single red corrupted trace smuggling a key-shaped glyph through a stream of benign teal telemetry packets toward a distant server

exploits

Injective npm SDK Backdoored to Steal Wallet Keys: Anatomy of a Near Miss

A compromised maintainer account backdoored 18 @injectivelabs npm packages on July 8, 2026, harvesting wallet seed phrases at key-derivation time. It failed by minutes. Here is how it nearly worked.

Dmitry Serdyuk·Jul 14, 2026

Abstract illustration of a DeFi vault: an external glowing token dropped into a side strategy module inflates a red share-price gauge past its safe band while value siphons out through a redemption channel, over dark teal circuitry.

exploits

Summer.fi's $6M Lazy Summer Exploit: When a Donation Broke the Vault Math

An attacker donated an asset into a Summer.fi Lazy Summer vault, inflated its totalAssets() share price, and redeemed a flash loan for a $6M profit. No key was stolen. The accounting was the hole.

Dmitry Serdyuk·Jul 8, 2026

An oversized hand drops a stack of votes that outweighs a scattered crowd on a tipping scale, swinging open a treasury vault as coins stream out.

exploits

BonkDAO's $20M Governance Takeover: When Buying the Vote Beats Hacking the Code

An attacker spent about $4M buying BONK, took a voting majority on BonkDAO's Realms governance, and passed one proposal that moved $20M out of the treasury. No contract was hacked. The rules were.

Dmitry Serdyuk·Jul 7, 2026

A deprecated on-chain vault whose guard inspects only one of thirty-two settlement slots, with forged teal deposit blocks slipping through the unverified gap while a single red slot drains assets from the sealed pool.

exploits

Aztec Connect's $2.19M Exploit: A ZK-Rollup Settlement Bug in a Contract No One Could Patch

A deprecated Aztec Connect contract was drained of $2.19M when its L1 settlement loop and its ZK proof disagreed on how many slots were real. Its keys were renounced, so no one could pause it.

Dmitry Serdyuk·Jul 5, 2026

Autonomous MEV bot following teal approval streams into a red honeypot trap of counterfeit token contracts as an attacker coordinator sweeps funds

exploits

JaredFromSubway MEV Bot Drained for $7.5M in a Counter-MEV Honeypot

JaredFromSubway, Ethereum's most prolific MEV sandwich bot, was drained of $7.5M when an attacker turned its own logic into a counter-MEV honeypot. How the dangling-approval attack worked.

Aron Turner·Jun 23, 2026

Dark founder desk with a glowing digital field guide for Australia's startup ecosystem

research

The Map Already Exists: Building a Digital-Economy Startup in Australia in 2026

Australia ranks 16th on innovation inputs but 27th on outputs. The gap is not talent, it is plumbing. A field guide to the grants, funds and pathways open today, and what to copy from abroad.

Alex Rybalko·Jun 17, 2026

45m

Forensic audit table showing a Solana program account graph under magnification, with seven vulnerability tiles flagged for validation, CPI, PDA, signer, arithmetic, sysvar, and oracle risks

research

Solana Smart Contract Vulnerabilities: The Patterns Behind $500M in Exploits

Wormhole $320M, Mango $114M, Cashio $52M. None of them were Rust bugs. The seven vulnerability classes behind Solana's biggest exploits, and what an audit checks for each.

Alex Rybalko·Jun 12, 2026

One compromised laptop holding seven signing keys that cleared a 3-of-6 and a 3-of-5 multisig across two chains

exploits

Humanity Protocol's $36M Key Compromise: A Runbook for Wallets That Touch Contracts

One compromised laptop held seven keys and cleared two multisigs, draining $36M+ from Humanity Protocol. A runbook for segregating, monitoring, and revoking project wallets that touch contracts.

Dmitry Serdyuk·Jun 10, 2026

Third-party Safe module bypassing intact signature shields with a public hardcoded authorization key

exploits

The $3.2M SquidRouterModule Exploit: How a Public String Drained 86 Safe Wallets

A third-party module named SquidRouterModule drained $3.2M from 86 Gnosis Safe wallets on Ethereum and Base. Full attack chain, the auth flaw, and the lesson.

Aron Turner·May 26, 2026

Poisoned developer IDE extension exfiltrating internal repositories and secrets into an external archive vault

exploits

GitHub's 3,800-Repo Breach: How a Poisoned VS Code Extension Burned the World's Biggest Code Host

One poisoned VS Code extension on one GitHub employee's laptop cost the company ~3,800 internal repositories. Here is the attack chain, the Mini Shai-Hulud worm internals, and the rotate-everything checklist that follows.

Aron Turner·May 21, 2026

BSC reserve manipulation exploit pattern — thin-liquidity pools, burn mechanics, and reserve-derived pricing audit checklist

research

Reserve Manipulation Isn't Dead

Seven BSC pools drained $3M in 2026 H1 — same reserve-manipulation primitive every time. Here's what auditors keep missing.

Alex Rybalko·May 20, 2026

Web3 release pipeline audit checklist for npm provenance, lifecycle hooks, cache poisoning, and deployer-key exposure

research

Audit the Release Pipeline Like a Smart Contract

Your contracts are audited. Your release pipeline isn't. Mini Shai-Hulud proved npm provenance signs whatever a compromised workflow ships. Here's the checklist Web3 teams should run on their own pipeline.

Dmitry Serdyuk·May 19, 2026

Linux kernel privilege escalation mapped to Web3 infrastructure risk

research

Copy Fail: When a Linux Bug Becomes Protocol Risk

Copy Fail is a Linux kernel privilege escalation, not a smart contract bug. For Web3 teams running validators, CI runners, deployer hosts, and signing infrastructure, that's exactly why it matters.

Dmitry Serdyuk·May 5, 2026

Breached cyberpunk vault door with a single compromised lock: the 1-of-1 LayerZero DVN that let $292M leave Kelp DAO

exploits

Kelp DAO's $292M Hack and Aave's $6B Fallout: One Config Parameter Broke DeFi

A 1-of-1 LayerZero DVN let attackers drain 116,500 rsETH ($292M) from Kelp DAO, loop it through Aave V3 for $266M in ETH, and wipe $6B in Aave TVL in 24 hours. No Solidity bug. One config parameter broke DeFi.

Aron Turner·Apr 20, 2026

Timeline graphic of the Delve compliance fraud scandal from founding through YC expulsion

case-studies

The Delve Scandal: How a $300M Compliance Startup Sold Fake SOC 2 Reports and Got Expelled from YC

YC expelled Delve after an investigation revealed 493 of 494 SOC 2 reports were identical boilerplate. Here's the full breakdown of the $300M compliance fraud.

Alex Rybalko·Apr 9, 2026

Drift Protocol $270M exploit breakdown — Solana durable nonces weaponized in DPRK-attributed multisig attack

exploits

Drift Protocol's $270M Exploit: How Solana's Durable Nonces Became a Social Engineering Weapon

An attacker drained $270M from Drift Protocol by abusing Solana's durable nonce feature to pre-sign malicious multisig transactions weeks before execution.

Aron Turner·Apr 3, 2026

industry

How to Choose a Smart Contract Audit Firm Without Getting Burned

A framework for evaluating audit firms based on methodology, track record, and specialization, not marketing. What to look for, what to avoid, and the questions most teams forget to ask.

Kolin Cunningham·Mar 20, 2026

Smart contract audit preparation checklist

technical

Smart Contract Audit Checklist: What to Prepare Before Your Engagement

The preparation checklist that separates smooth audit engagements from costly delays. What your team needs to have ready before auditors touch your code.

Dmitry Serdyuk·Mar 20, 2026

industry

What Does a Smart Contract Audit Actually Cost in 2026

Real audit pricing data from 2026. What affects cost, what you should expect to pay, and how to evaluate whether an audit is worth the investment for your protocol.

Aron Turner·Mar 20, 2026

Claude Code Security vs OpenAI Codex Security comparison

research

Claude Code Security vs Codex Security: What Each AI Vulnerability Scanner Actually Delivers

Anthropic and OpenAI both shipped AI-powered vulnerability scanners in early 2026. We break down what each tool actually does, where they fall short, and why neither one replaces a smart contract audit.

Dmitry Serdyuk·Mar 18, 2026

Aave oracle liquidation incident breakdown

exploits

Aave's $27M Liquidation Incident: How a Stale Oracle Parameter Wiped Out 34 Users

A desynchronized oracle parameter caused Aave to undervalue wstETH by 2.85%, triggering $27M in wrongful liquidations across 34 users. Full technical breakdown.

Aron Turner·Mar 12, 2026

Smart contract audit report structure and deliverables

industry

What to Expect From a Smart Contract Audit Report

What a professional audit report actually contains, how findings are classified, and how to use the report to ship secure code, not just check a compliance box.

Aron Turner·Mar 10, 2026

AI-assisted smart contract auditing visualization

research

AI's Growing Role in Auditing and Cybersecurity

With smart contract deployments hitting a record 8.7M per quarter, manual review can't keep up. Discover why AI-assisted auditing is the only realistic way to close the Web3 security gap.

Aron Turner·Mar 2, 2026

Social engineering and phishing threats in Web3 security

research

The Human Factor: Why Web3's Biggest Threat in 2026 Isn't Bad Code — It's People

In 2025, social engineering drove 55% ($1.39B) of crypto losses. As attackers pivot from smart contracts to phishing, learn why true Web3 security requires more than just code audits.

Kolin Cunningham·Feb 26, 2026

research

What $10.77 Billion in Hacks Reveals About Audit Effectiveness

Analysis of 100 largest protocol hacks totaling $10.77B. Only 20% were audited, but the ones that were share a pattern. Firm comparison, verified exploit data, pricing, and evaluation criteria.

Alex Rybalko·Feb 25, 2026